Skills governance — agent-skill & MCP runtime authority demo

An installed AI agent skill tries to act — call a tool, reach a Model Context Protocol (MCP) server, read a path, or write a change. A scanner can tell you the skill artefact is clean; KYE Protocol™ proves the clean skill stayed in its lane: was the MCP server allow-listed, the data scope within its grant, and the action class permitted — then it seals a signed, replay-provable Evidence Pack™. With 969 malicious agent skills found in one year, the question is no longer "is the skill clean" but "what was it authorised to do".

All logic runs in your browser. The Evidence Pack™ hash is a real SHA-256 (Secure Hash Algorithm 256-bit) over canonical JSON, recomputable in your terminal.

Start the demo → RAG governance demo
1 — The installed skill + the action it attempts

Choose what the skill tries to do

You installed this skill with a declared binding: it may call one allow-listed MCP server, read a single project path, and act read-only. Pick what the skill attempts — an off-list server, a path it never declared, or a privileged write — then run the admissibility check.

2 — Action-admissibility gate

Five rules, in order

The gate runs five rules. Each returns ALLOW or REFUSE. A single refusal stops the skill and shows the exact reason code you receive — the same binding KYE enforces in production for agents and MCP servers.

    3 — Skill-authority Evidence Pack

    The artefact you show a security reviewer or auditor

    When every rule allows the action, KYE seals the Evidence Pack™. It binds the skill identity, its declared authority, the requested action, and the rule results — verifiable offline from published keys alone, valid at T=0. If the skill is later compromised, the pack proves exactly which actions it was ever authorised to take.

    Run the check to build the Evidence Pack™.

    
      
    
    
    

    
    
      Honest scope
      
    What this demo proves — and what it does not
    
      
    KYE governs the runtime authority of an installed agent skill or MCP server — which servers it may call, which scope it may touch, which action class it may take, and whether each action is evidenced, replayable, and final. KYE does not scan the skill artefact for malware, run a skill marketplace, or replace your software-supply-chain scanner — that is a different, complementary layer. It reuses the canonical §52 delegated-agent binding and the MCP allow-list manifest. The skill's code and your install decision remain yours.